CVE-2023-52977

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix flow memory leak in ovs_flow_cmd_new

Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is
not freed when an allocation of a key fails.

BUG: memory leak
unreferenced object 0xffff888116668000 (size 632):
  comm "syz-executor231", pid 1090, jiffies 4294844701 (age 18.871s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000defa3494>] kmem_cache_zalloc include/linux/slab.h:654 [inline]
    [<00000000defa3494>] ovs_flow_alloc+0x19/0x180 net/openvswitch/flow_table.c:77
    [<00000000c67d8873>] ovs_flow_cmd_new+0x1de/0xd40 net/openvswitch/datapath.c:957
    [<0000000010a539a8>] genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739
    [<00000000dff3302d>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
    [<00000000dff3302d>] genl_rcv_msg+0x328/0x590 net/netlink/genetlink.c:800
    [<000000000286dd87>] netlink_rcv_skb+0x153/0x430 net/netlink/af_netlink.c:2515
    [<0000000061fed410>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
    [<000000009dc0f111>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
    [<000000009dc0f111>] netlink_unicast+0x545/0x7f0 net/netlink/af_netlink.c:1339
    [<000000004a5ee816>] netlink_sendmsg+0x8e7/0xde0 net/netlink/af_netlink.c:1934
    [<00000000482b476f>] sock_sendmsg_nosec net/socket.c:651 [inline]
    [<00000000482b476f>] sock_sendmsg+0x152/0x190 net/socket.c:671
    [<00000000698574ba>] ____sys_sendmsg+0x70a/0x870 net/socket.c:2356
    [<00000000d28d9e11>] ___sys_sendmsg+0xf3/0x170 net/socket.c:2410
    [<0000000083ba9120>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439
    [<00000000c00628f8>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
    [<000000004abfdcf4>] entry_SYSCALL_64_after_hwframe+0x61/0xc6

To fix this the patch rearranges the goto labels to reflect the order of
object allocations and adds appropriate goto statements on the error
paths.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
LinuxCNA
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 1%
VendorProductVersion
linuxlinux_kernel
4.9.337 ≤
𝑥
< 4.10
linuxlinux_kernel
4.14.303 ≤
𝑥
< 4.14.306
linuxlinux_kernel
4.19.270 ≤
𝑥
< 4.19.273
linuxlinux_kernel
5.4.229 ≤
𝑥
< 5.4.232
linuxlinux_kernel
5.10.163 ≤
𝑥
< 5.10.168
linuxlinux_kernel
5.15.86 ≤
𝑥
< 5.15.93
linuxlinux_kernel
6.0.16 ≤
𝑥
< 6.1
linuxlinux_kernel
6.1.2 ≤
𝑥
< 6.1.11
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
5.10.223-1
fixed
bullseye (security)
5.10.234-1
fixed
bookworm
6.1.129-1
fixed
bookworm (security)
6.1.128-1
fixed
trixie
6.12.19-1
fixed
sid
6.12.20-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
linux-allwinner-5.19
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-aws
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
linux-aws-5.0
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-aws-5.11
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.13
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.15
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-aws-5.19
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-aws-5.3
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-aws-5.4
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-aws-5.8
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-6.2
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-aws-6.5
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-aws-6.8
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-aws-fips
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-aws-hwe
oracular
dne
noble
dne
jammy
dne
focal
dne
xenial
needs-triage
linux-azure
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
ignored
xenial
needs-triage
trusty
needs-triage
linux-azure-4.15
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-azure-5.11
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.13
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.15
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-5.19
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-azure-5.3
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-azure-5.4
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-azure-5.8
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-6.2
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-azure-6.5
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-azure-6.8
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-azure-edge
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-azure-fde
oracular
dne
noble
dne
jammy
needs-triage
focal
ignored
linux-azure-fde-5.15
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-fde-5.19
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-azure-fde-6.2
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-azure-fips
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-bluefield
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-fips
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-gcp
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
ignored
xenial
needs-triage
linux-gcp-4.15
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-gcp-5.11
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.13
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.15
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-gcp-5.19
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-gcp-5.3
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-gcp-5.4
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-gcp-5.8
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-6.2
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-gcp-6.5
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-gcp-6.8
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-gcp-fips
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-gke
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
ignored
linux-gke-4.15
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-gke-5.15
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gke-5.4
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-gkeop
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
ignored
linux-gkeop-5.15
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gkeop-5.4
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-hwe
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
needs-triage
linux-hwe-5.11
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.13
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.15
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-hwe-5.19
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-hwe-5.4
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-hwe-5.8
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-6.11
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-hwe-6.2
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-hwe-6.5
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-hwe-6.8
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-hwe-edge
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
ignored
linux-ibm
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
needs-triage
linux-ibm-5.15
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-ibm-5.4
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-intel-5.13
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-intel-iot-realtime
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-intel-iotg
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-intel-iotg-5.15
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-iot
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-kvm
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-lowlatency
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
dne
linux-lowlatency-hwe-5.15
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-lowlatency-hwe-5.19
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-lowlatency-hwe-6.11
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-lowlatency-hwe-6.2
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-lowlatency-hwe-6.5
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-lowlatency-hwe-6.8
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-lts-xenial
oracular
dne
noble
dne
jammy
dne
focal
dne
trusty
needs-triage
linux-nvidia
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
dne
linux-nvidia-6.2
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-nvidia-6.5
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-nvidia-6.8
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-nvidia-lowlatency
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-nvidia-tegra
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
dne
linux-nvidia-tegra-igx
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-oem
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-oem-5.10
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.13
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.14
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.17
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-oem-5.6
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-6.0
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-oem-6.1
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-oem-6.11
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-oem-6.5
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-oem-6.8
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-oracle
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-oracle-5.0
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-oracle-5.11
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.13
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.15
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-oracle-5.3
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-oracle-5.4
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-oracle-5.8
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-6.5
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-oracle-6.8
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-raspi
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
linux-raspi-5.4
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-raspi-realtime
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-raspi2
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-realtime
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
dne
linux-riscv
oracular
needs-triage
noble
needs-triage
jammy
ignored
focal
ignored
linux-riscv-5.11
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-riscv-5.15
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-riscv-5.19
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-riscv-5.8
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-riscv-6.5
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-riscv-6.8
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-starfive-5.19
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-starfive-6.2
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-starfive-6.5
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-xilinx-zynqmp
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage